# Filebeat processors decode\_json\_fields with condition not working

**URL:** <https://discuss.elastic.co/t/filebeat-processors-decode-json-fields-with-condition-not-working/217903>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 5, 2020, 5:18am UTC](https://discuss.elastic.co/t/filebeat-processors-decode-json-fields-with-condition-not-working/217903 "2020-02-05T05:18:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kunal\_Saha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kunal_saha/32/62087_2.png) [@Kunal\_Saha](https://discuss.elastic.co/u/Kunal_Saha)\
**Post date:** [February 5, 2020, 5:18am UTC](https://discuss.elastic.co/t/filebeat-processors-decode-json-fields-with-condition-not-working/217903/1 "2020-02-05T05:18:57Z")

</div>

My log file has entries line below.  
{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"shail","time":"2017-11-03T17:02:28.001Z","v":0}  
{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"jitu","time":"2017-11-03T17:02:28.001Z","v":0}  
2020-01-15 07:01:01.634 INFO 13 :{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"hello","time":"2017-11-03T17:02:25.994Z","v":0}  
2020-01-15 07:01:01.634 INFO 13 :{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"world","time":"2017-11-03T17:02:26.997Z","v":0}  
2020-01-15 07:01:01.634 INFO 13 :{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"jitu","time":"2017-11-03T17:02:28.001Z","v":0}

I want to parse all json data as fields.  
The log line which contain complete json data, has no issue, i passes every json keys as fields within kibana.  
` {"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"shail","time":"2017-11-03T17:02:28.001Z","v":0}`

But it's not working for the one that contains some other data pre aligned with json data.  
`2020-01-15 07:01:01.634 INFO 13 :{"name":"foo","hostname":"local","pid":21894,"level":30,"msg":"hello","time":"2017-11-03T17:02:25.994Z","v":0}`

I'm trying to processors with decode\_json\_fields and aligned with regex condition.

here is my config.

> processors:
> 
> - decode\_json\_fields:  
> when:  
> regexp:  
> message: "^.\*{"

What I'm doing wrong here ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 5:19am UTC](https://discuss.elastic.co/t/filebeat-processors-decode-json-fields-with-condition-not-working/217903/2 "2020-03-04T05:19:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.